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~ The MAILING DATE of this communication appears on the cover sheet with the correspondence address 
Period for Reply 



A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 1 MONTH(S) OR THIRTY (30) DAYS. 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 .136(a)> In no event, however, may a reply be timely filed 
after SIX (6) MONTIHS from the mailing date of this communication. 

• tf NO period for reply is specified above, the maximum statutory period will apply and will expire SIX (6) MONTHS from the mailing date of this communication. 

- Failure to reply within the set or extended period for reply will, by statute, cause the application to become ABANDONED (35 U.S.C. § 133). 
Any reply received by the Office later than three months after the mailing date of this communication, even if timely filed, may reduce any 
eamed patent term adjustment. See 37 CFR 1 .704(b). 

Status 

Responsive to comnnunication(s) filed on 01 December 2006 , 
2a)n This action is FINAL. 2b)El This action is non-final. 

3) n Since this application is in condition for allowance except for fonnal matters, prosecution as to the merits is 

closed in accordance with the practice under Exparfe Quayle, 1935 CD. 11, 453 O.G, 213. 

Disposition of Claims 

4) IS Claim(s) 1-122 is/are pending in the application. 

4a) Of the above claim(s) is/are withdrawn from consideration. 

5) n Claim(s) is/are allowed. 

6) 0 Claim(s) is/are rejected. 

?)□ Claim(s) is/are objected to. 

8) ISI Claim(s) 1-122 are subject to restriction and/or election requirement. 

Application Papers 

9) n The specification is objected to by the Examiner. 

10) n The drawing(s) filed on is/are: a)n accepted or b)n objected to by the Examiner. 

Applicant may not request that any objection to the drawing(s) be held in abeyance. See 37 CFR 1.85(a). 
Replacement drawing sheet(s) including the correction Is required if the drawing(s) Is objected to. See 37 CFR 1.121(d). 

1 1) D The oath or declaration is objected to by the Examiner. Note the attached Office Action or fomi PTO-152. 

Priority under 35 U.S.C. § 1 1 9 

12) 0 Acknowledgment is made of a claim for foreign priority under 35 U.S.C. § 1 19(a)-(d) or (f). 
a)n All b)n Some * c)n None of: 

1 .□ Certified copies of the priority documents have been received. 

2. D Certified copies of the priority documents have been received in Application No. . 

3. D Copies of the certified copies of the priority documents have been received in this National Stage 

application from the International Bureau (PCT Rule 17.2(a)). 
* See the attached detailed Office action for a list of the certified copies not received. 
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DETAILED ACTION 

1. This action is in response to the communication filed on December 1 1 , 2006. 

Election/Restrictions 

2. Restriction to one of the following inventions is required under 35 U.S.C. 121 : 

I. Claims 1 - 42. 43 - 70, 71 - 77. 1 10 - 1 12 and 1 13 - 122. drawn to a 
system, a method to remotely acquire computer forensic evidence and 
analyze the acquired forensic evidence, including analysis of data relating 
to reconstruction of computer usage and examination of residual data, i.e., 
detecting or observing operating characteristics or conditions of computers 
connected through a computer network or of the network itself, classified 
in class'709, subclass 224, computer network monitoring. 

II. Claims 78 - 86, 87-101 and 102 - 109, drawn to a method of analyzing 
the log file to detect tampering (including deliberately entering false data 
or changing and detecting true data), i.e. monitoring or scanning of 
software or data to prevent or detect attacks, classified in class 726, 
subclass 22. 

3. Inventions I, and II are related as subcombinations disclosed as usable together 
in a single combination. The subcombinations are distinct from each other if they are 
shown to be separately usable. In the instant case, invention I has separate utility such 
as a method for determining the distance between a first point and a second point on a 
storage medium to determine the distance between a first and second read apparatus, 
classified in a different Class/Subclass. Invention II has separate utility such as a 
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storage medium where the information is encrypted using a signature, classified in a 
different Class/Subclass. See MPEP 806.05(d). 

The inventions are distinct, each from the other, because of the following reasons: 

(a) These inventions have acquired a separate status in the art as shown by their 
different classifications. 

(b) The search required for each Group is different and not co-extensive for 
examination purposes. 

For example, the searches for the two inventions would not be co-extensive 
because these Groups would require different searches on PTO's classification class 
and subclass as following: 

The Group I search (claims 1 - 42, 43 - 70, 71 - 77, 1 1 0 - 1 1 2 and 1 1 3 - 1 22) 
would require use of search class 709, subclass 224 (not require for the inventions II). 

The Group II search (claims 78 - 86, 87-101 and 102 - 109) would require use 
of search class 726, subclass 22 (not require for the inventions I), 

For the reasons given above restriction for examination purposes as indicated is 
proper. 

4. Applicant is advised that the reply to this requirement to be complete must 
include an election of the invention to be examined even though the requirement be 
traversed (37 CFR 1.143), 

5, Applicant is reminded that upon the cancellation of claims to a non-elected 
invention, the inventorship must be amended in compliance with 37 CFR 1 .48 (b) if one 
or more of the currently named inventors is no longer an inventor of at least one claim 
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remaining in the application. Any amendment of inventorship must be accompanied by 
a petition under 37 CFR 1 .48 (b) and by the fee required under 37 CFR 1.17 (h). 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Pramila Parthasarathy whose telephone number is 571- 
272-3866. The examiner can normally be reached on 8:00a.m. To 5:00p.m.. If attempts 
to reach the examiner by telephone are unsuccessful, the examiner's supervisor, 
Nasser Moazzami can be reached on 571-232-4195. Any inquiry of a general nature or 
relating to the status of this application or proceeding should be directed to the 
receptionist whose telephone number is 703-305-3900. 

Information regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for published 
applications may be obtained from either Private PAIR or Public PAIR only. For more 
information about the PAIR system, contact the Electronic Business Center (EBC) at 
866-217-9197 (toll-free). 



Conclusion 



August 26, 2007. 



Pramila Parthasarath 
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